← Back

CVE-2018-15425

nvd nist
Published: Oct 5, 2018Modified: Nov 21, 2024

JSON object

Loading...
4.7
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Exploitability: 1.2 / Impact: 3.4
Source: NVD

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server.

Affected (8)

Cisco
1 product
Identity Services Engine
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Cisco
Identity Services Engine
Version 2.1(0.474)
Identity Services Engine
Version 2.1(0.907)
Identity Services Engine
Version 2.2(0.470)
Identity Services Engine
Version 2.2(0.909)
Identity Services Engine
Version 2.3(0.298)
Identity Services Engine
Version 2.3(0.905)
Identity Services Engine
Version 2.4(0.357)
Identity Services Engine
Version 2.4(0.904)

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

Source: psirt@cisco.com
Third Party AdvisoryVDB Entry
Source: psirt@cisco.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.